Salesforce B2C Commerce: Scripts demoing calling APIs and Controllers

1-pwa-new-guest-visitor.sh

#!/bin/bash
# Scenario 1: New Guest Visitor Lands on the PWA
set -euo pipefail

CODE=$CODE
ORG=$ORG
SITE=$SITE
CLIENT=$CLIENT
SECRET=$SECRET
HOST=$HOST

BASE_SCAPI="https://$CODE.api.commercecloud.salesforce.com"
BASE_AUTH="$BASE_SCAPI/shopper/auth/v1/organizations/$ORG"
BASE_OCAPI="https://$HOST/s/$SITE/dw/shop/v23_1"

COOKIE_JAR="cookies.txt"
TOKEN_FILE="token.json"
rm -fr "$COOKIE_JAR" "$TOKEN_FILE" 2>/dev/null

# 1️⃣ Get access token
echo "--> POST $BASE_AUTH/oauth2/token"
RESPONSE=$(
    curl "$BASE_AUTH/oauth2/token" \
        -sS --fail-with-body \
        -u "$CLIENT:$SECRET" \
        -d 'grant_type=client_credentials' |
        tee "$TOKEN_FILE"
)
TOKEN=$(echo $RESPONSE | jq -r '.access_token')
echo $TOKEN | jq -rR 'split(".") | .[1] | @base64d | fromjson'

# 2️⃣ Get DW cookies
echo "--> POST $BASE_OCAPI/sessions"
curl "$BASE_OCAPI/sessions" \
    -sSi --fail-with-body \
    -X 'POST' \
    -H "Authorization: Bearer $TOKEN" \
    -c "$COOKIE_JAR" |
    grep -i 'dwsid' | cut -d' ' -f2 | cut -d '=' -f2- | tr -d ';\n\r'

# 3️⃣ Now, we're in a position to call SCAPI/OCAPI or Controllers! 🎊

2-sfra-new-guest-visitor.sh

#!/bin/bash
# Scenario 2: New GUEST lands on SFRA/SG.
set -euo pipefail

CODE=$CODE
ORG=$ORG
SITE=$SITE
CLIENT=$CLIENT
SECRET=$SECRET
HOST=$HOST

BASE_SCAPI="https://$CODE.api.commercecloud.salesforce.com"
BASE_AUTH="$BASE_SCAPI/shopper/auth/v1/organizations/$ORG"
BASE_OCAPI="https://$HOST/s/$SITE/dw/shop/v23_1"

COOKIE_JAR="cookies.txt"
TOKEN_FILE="token.json"
rm -fr "$COOKIE_JAR" "$TOKEN_FILE" 2>/dev/null

# 1️⃣ Get DW cookies
echo "--> GET https://$HOST/on/demandware.store/Sites-$SITE-Site/default/DWSIG-Show"
RESPONSE=$(curl "https://$HOST/on/demandware.store/Sites-$SITE-Site/default/DWSIG-Show" \
    -sS --fail-with-body \
    -c "$COOKIE_JAR")
DWSID=$(grep -i 'dwsid' "$COOKIE_JAR" | cut -f7)
DWSGST=$(echo $RESPONSE | jq -r '.dwsig')

# 2️⃣ Get access token
echo "--> GET $BASE_AUTH/oauth2/session-bridge/token"
curl "$BASE_AUTH/oauth2/session-bridge/token" \
    -sS --fail-with-body \
    -u "$CLIENT:$SECRET" \
    -d 'grant_type=client_credentials' \
    -d 'hint=sb-guest' \
    -d "login_id=guest" \
    -d "channel_id=$SITE" \
    -d "dwsgst=$DWSGST" | tee $TOKEN_FILE | jq

# 3️⃣ Now, we're in a position to call SCAPI/OCAPI or Controllers! 🎊

3-returning-visitor.sh

#!/bin/bash
# Scenario 3: Returning Guest Visitor Lands on PWA or SFRA/SG.
set -euo pipefail

CODE=$CODE
ORG=$ORG
SITE=$SITE
CLIENT=$CLIENT
SECRET=$SECRET
HOST=$HOST

BASE_SCAPI="https://$CODE.api.commercecloud.salesforce.com"
BASE_AUTH="$BASE_SCAPI/shopper/auth/v1/organizations/$ORG"
BASE_OCAPI="https://$HOST/s/$SITE/dw/shop/v23_1"

# 1️⃣ Get persisted refresh token
TOKEN_FILE="token.json"
REFRESH=$(jq <$TOKEN_FILE -r '.refresh_token')

# 2️⃣ Get access token
echo "--> POST $BASE_AUTH/oauth2/token?grant_type=refresh_token"
RESPONSE=$(
    curl "$BASE_AUTH/oauth2/token" \
        -sS --fail-with-body \
        -u "$CLIENT:$SECRET" \
        -d 'grant_type=refresh_token' \
        -d "refresh_token=$REFRESH" |
        tee "$TOKEN_FILE"
)
TOKEN=$(echo $RESPONSE | jq -r '.access_token')
echo $TOKEN | jq -rR 'split(".") | .[1] | @base64d | fromjson'

# 3️⃣ Get DW cookies
echo "--> POST $BASE_OCAPI/sessions"
curl "$BASE_OCAPI/sessions" \
    -sSi --fail-with-body \
    -X 'POST' \
    -H "Authorization: Bearer $TOKEN" \
    -c "$COOKIE_JAR" |
    grep -i 'dwsid' | cut -d' ' -f2 | cut -d '=' -f2- | tr -d ';\n\r'

# 4️⃣ Now, we're in a position to call SCAPI/OCAPI or Controllers! 🎊

Based off this doc: https://salesforce.quip.com/i1L0AAmIFPn1

Assumes env vars like the following:

CODE='kv7kzm78'
ORG='f_ecom_zzrf_006'
SITE='RefArch'
CLIENT='42e84fb7-fb6e-4985-aece-a15fafc81544'
SECRET='REDACTED'
HOST='zzrf-006.dx.commercecloud.salesforce.com'

The special controller referenced, DWSIG-Show has the following implementation:

function showDWSIG() {
    var dwsig
    if ("generateGuestSessionSignature" in session) {
        dwsig = session.generateGuestSessionSignature()
    } else {
        dwsig = "Not supported"
    }

    response.addHttpHeader("Content-Type", "application/json")
    response.writer.print(JSON.stringify({dwsig: dwsig}, null, 4))
}

showDWSIG.public = true
exports.Show = showDWSIG